Fix for non-regexps being upgraded to SVt_REGEXP

$ ./perl -lwe '$a = ${qr//}; $a = 2; print re::is_regexp(\$a)'
1

It is possible for arbitrary SVs (eg PAD entries) to be upgraded to
SVt_REGEXP.  (This is new with first class regexps)

Whilst the example above does not SEGV, it will be possible to write
code that will cause SEGVs (or worse) at the point when the scalar is freed,
because the code in sv_clear() assumes that all scalars of type
SVt_REGEXP *are* regexps, and passes them to pregfree2(), which assumes that
pointers within are valid.

1 files changed, 1 insertions, 0 deletions

diff --git a/regcomp.c b/regcomp.c
index 10f97b93ea..ecea32d4e3 100644
--- a/regcomp.c
+++ b/regcomp.c
@@ -9457,6 +9457,7 @@ Perl_reg_temp_copy (pTHX_ REGEXP *ret_x, REGEXP *rx)
     memcpy(&(ret->xpv_cur), &(r->xpv_cur),
 	   sizeof(regexp) - STRUCT_OFFSET(regexp, xpv_cur));
     SvLEN_set(ret_x, 0);
+    SvSTASH_set(ret_x, NULL);
     Newx(ret->offs, npar, regexp_paren_pair);
     Copy(r->offs, ret->offs, npar, regexp_paren_pair);
     if (r->substrs) {